I wanted to hold off on the newly stabilized firefox 60 ESR update on some of my machines for a few more days (try it out on others first, see what's broken, search for workaround, etc), but it is slightly more complicated than just masking the new firefox, so I'll document it here:

In /etc/portage/package.mask, add:

Code:

>=www-client/firefox-60
>=dev-libs/nspr-4.19
>=dev-libs/nss-3.37

If you previously built firefox 52.9.0 with the updated nspr and/or nss, you'll need to rebuild it again after downgrading nss and nspr. revdep-rebuild doesn't seem to catch this.

I wouldn't recommend leaving these masked for long. The ebuilds will probably disappear before long, and even if you keep your own copies in your own overlay, the lack of security updates will probably get you eventually. Bite the bullet and update, or switch to the pale moon overlay, or something.

Bugs/Symptoms I've Seen

I was getting weird problems from my cookie exceptions from permissions.sqlite being ignored when using the new nspr and nss with firefox 52.9. All my cookies were being dropped (my default), including ones I had marked as exceptions (leaving me unable to log into slashdot, etc). (Speculation: Maybe other sqlite problems as well?)

After downgrading nss and nspr, but before rebuilding 52.9.0 again with the older nss and nspr, the above cookie problem was fixed, but I was getting NS_ERROR_NET_INADEQUATE_SECURITY errors trying to look things up on google. (But oddly, at least some other https sites were working.)

Incomplete, miscellaneous tips for making firefox-60 less painful

Stop trying to stick with the original "Releigh" theme on newer versions of gtk-3.0. These days it has way too many little bugs. Start with the new default (Adwaita or something) instead.

Add "gtk-primary-button-warps-slider = false" to the "[Settings]" section of /etc/gtk-3.0/settings.ini (and comment out any previous attempts to keep "Releigh").

The noscript extension still works. The menu for tweaking noscript configuration looks/acts a little different, but it is still usable.

Right click on the toolbar and do what customization you can. Not as complete as the no-longer-supported "classic theme restorer" extension, but there is still some configurability. Besides customizing the toolbar itself, I've got options for enabling bookmark bar and menu bar, although I'm not sure if they are available on a fresh profile. The "reload" and "stop" buttons were already to the left side of the address bar (instead of inside of it), but maybe that was some vestige of something the classic theme restorer had done earlier (or maybe they restored that in the default UI since they broke it?). There were some blank/wasted spacers on the toolbar, but they were easily removed.

https://support.mozilla.org/en-US/questions/1184737 has instructions and a link to a .css file that is claimed to restore putting tabs below the toolbar, but I haven't confirmed it it actually works yet. Other links imply lots of UI configurability via css, but I don't know where it is actually documented.

Stop trying to stick with the original "Releigh" theme on newer versions of gtk-3.0. These days it has way too many little bugs. Start with the new default (Adwaita or something) instead.

You can override the theme firefox uses in about:config, independent of the outer desktop:

Code:

widget.content.gtk-theme-override=Adwaita

Quote:

I've got options for enabling bookmark bar and menu bar, although I'm not sure if they are available on a fresh profile.

Yes they are.

Quote:

The "reload" and "stop" buttons were already to the left side of the address bar (instead of inside of it), but maybe that was some vestige of something the classic theme restorer had done earlier.

That's the new default. You can move the button to the right, but not into the address bar. I don't know if "reload" and "stop" can be separated somehow._________________My phrenologist says I'm stupid.

The new tab page has been remodeled. The new design is optimized for cramming in as many "sponsored stories" (advertisements) as possible. That bullshit can be disabled in the new tab options but if you disable all of it the new tab page looks barren. By setting browser.newtabpage.activity-stream.topSitesRows=6 you get a lot more "top sites" that you can pin to anything you want like in 52.

If you open a youtube video in a new tab to have it play in the background it will no longer play unless you give that tab focus first. That feature can be disabled with media.block-autoplay-until-in-foreground=false.

Loading URLs from the clipboard with middle click is disabled by default (not a bad idea). If you are aware of the risks and are careful you can re-enable it with middlemouse.contentLoadURL=true.

In 60 ESR it's webextensions or nothing. XUL/XPCOM based extensions won't work. The biggest fallout for me was that my mouse gesture extension, firegestures, didn't work. The best replacement I've found is foxy gestures but it requires firefox-61 and the ESR branch is 60. Webextensions only work on webpages so gestures won't work on setting pages or the new tab page. It's impossible to make a proper mouse gesture extention with webextensions with the current limitations.

The ugly workaround I use is to use x11-misc/easystroke to recognize gestures and inject keypresses to the browser. This limits me to functionality available as keyboard shortcuts but it's good enough for me. Easystroke is abandonware and really bitrotten. It segfaults all the time when changing configuration and have a lot of other glitches with the gui. I couldn't find anything better.

The webextensions version of NoScript was a downgrade. Lots of options disappeared. I decided to say goodbye to NoScript and try out uMatrix instead. uMatrix is a lot more powerful and complicated. It's not obvious how to use it without reading the manual. https://github.com/gorhill/uMatrix/wiki/The-popup-panel is the most important info for how to use it but all the other pages on the wiki are also useful. Once I've learned how it works it both better and easier to use than NoScript.

On every major update it's a good idea to look through the list here and disable all the bullshit. https://github.com/pyllyukko/user.js
Pay extra attention to the "Firefox (anti-)features" sections. The sad truth is that Mozilla can't be trusted anymore:

I wanted to hold off on the newly stabilized firefox 60 ESR update on some of my machines for a few more days (try it out on others first, see what's broken, search for workaround, etc), but it is slightly more complicated than just masking the new firefox

firefox-60 emerge failed continuously and after a few attempts, i couldn't be bothered. esr-52 works fine atmo. i only masked firefox-60, as i seem to have no issues with updated nspr or nss.

i got used to not having gestures, after i moved away from opera. perhaps it's time to try again. i looked at your easystroke. it's keyworded unstable, and pulls in too many dependencies. i found another similar package x11-misc/xstroke, which is stable and has no other dependencies.

tholin wrote:

[*]On every major update it's a good idea to look through the list here and disable all the bullshit. https://github.com/pyllyukko/user.js
Pay extra attention to the "Firefox (anti-)features" sections. The sad truth is that Mozilla can't be trusted anymore:

thanks for these reminders. i've been wondering if it was just me, or has firefox lost it's way somewhere along with some corporate takeover or something? google chrome/chromium has become too big/bloated for me, and i moved away. not many alternatives sadly
i've revived my user.js again. hadn't touched it for a few years._________________"Growth for the sake of growth is the ideology of the cancer cell." Edward Abbey

As tholin mentioned, about:config's middlemouse.contentLoadURL default was changed to false (as I noticed within a couple of hours). I explicitly changed it back to true. The underlying logic was much improved several years ago to not try to load the a middle click paste as a URL unless it actually looks like a complete URL, with scheme and everything. Before that, I occasionally would mistakenly paste something sensitive like a password in the wrong place, and not only would it load something I didn't intend, it presumably sent my password out over the unencrypted DNS and/or search engine requests to do so, leaving me compelled to change the now-potentially-compromised password. But that hasn't been a problem for years. (Back then middle click stopped working with "URL"s that left out the scheme, but that seems like a small price to pay to avoid unintentional loads from miss-pasted passwords.)

To summarize the pulseaudio thread linked by tholon, alsa mostly works, but firefox may crash on an assertion when closing a tab with active audio. A workaround (that I haven't tried yet) involves disabling multiprocess rendering. (I was going to say alsa works for me, but then I read the thread and realized I had encountered the indicated crash, although I hadn't realized the cause - I was vaguely thinking some sort of ffmpeg bug.)

The Adwaita/Releigh theme issue was me trying to stick with a gtk2 default theme from the previous major firefox update. At that time I ended up just setting the USE flags to continue to build as much as possible against gtk2 instead of 3, although firefox 60 no longer has that option. Everything using gtk3 had similar theme bugs, so globally (instead of individual app) abandoning Releigh and tweaking Adwaita really seems best overall...